A program is a file stored on disk. It contains instructions and data that tell the kernel how to build a process in memory when the program is executed. The most common executable format on modern Linux is ELF (Executable and Linking Format).

A program file holds several key pieces of information:

A process is an instance of a program that the kernel has loaded into memory and is actively running. The kernel creates a process by reading the program file and setting up memory, file descriptors, signal handlers, and other resources.

One program file can spawn many processes simultaneously. For example, you can open three terminal windows and run bash in each — three processes, one program.

Every running program is a process. This example prints basic facts that only a running process can know — its own PID.

#include <stdio.h>
#include <unistd.h>

int main(void)
{
    /* A program file has no PID — only a process does.
       Printing our PID proves we are a running process. */
    printf("I am a process. My PID is: %d\n", getpid());
    printf("My parent process PID is: %d\n", getppid());
    return 0;
}

/* Compile: gcc -o proc_id proc_id.c
   Run:     ./proc_id
   Output:
     I am a process. My PID is: 4821
     My parent process PID is: 4756   */

Using fork(), one program creates two processes. Both run the same code but have different PIDs.

#include <stdio.h>
#include <unistd.h>

int main(void)
{
    pid_t pid = fork();   /* Create a child process */

    if (pid == 0) {
        /* This block runs in the CHILD process */
        printf("CHILD process — PID: %d\n", getpid());
    } else {
        /* This block runs in the PARENT process */
        printf("PARENT process — PID: %d, child PID: %d\n",
               getpid(), pid);
    }
    /* Both parent and child continue here */
    printf("PID %d: Same program, two processes!\n", getpid());
    return 0;
}

/* Output (PIDs will vary):
   PARENT process — PID: 5100, child PID: 5101
   CHILD process  — PID: 5101
   PID 5100: Same program, two processes!
   PID 5101: Same program, two processes!  */

You can inspect the ELF header of any compiled program using readelf. This shows the binary format information stored in the program file.

#include <stdio.h>

int main(void)
{
    printf("Hello from my ELF binary!\n");
    return 0;
}

/* Compile and inspect:
   $ gcc -o hello hello.c

   $ readelf -h hello
   ELF Header:
     Magic:   7f 45 4c 46 02 01 01 00 ...   (ELF magic bytes)
     Class:   ELF64
     Type:    ET_EXEC (Executable file)
     Entry point address: 0x401060
     ...

   $ file hello
   hello: ELF 64-bit LSB pie executable, x86-64 ...

   The 'file' command reads the magic bytes and identifies
   the binary format — this is the "Binary Format ID" field
   described in the ELF specification. */